CVE-2007-4154 SQL injection in n/a
Authenticated administrators can execute arbitrary SQL commands via the page_options parameter in WordPress options pages.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-4154?
CVE-2007-4154 is a medium-severity SQL injection vulnerability in Wordpress Wordpress, published on 3 Aug 2007. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.
Which versions are affected by CVE-2007-4154?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2007-4154?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2007-4154 being exploited?
There is no known exploitation of CVE-2007-4154 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as DEBIAN-CVE-2007-4154, GHSA-jhw4-989v-7prf.